tcp
not tcp
not arp or !tcp
udp || tcp
udp && tcp
80 == tcp.srcport
not (tcp.dstport==443 and (tcp))
ip.version == 6
tcp.srcport == 80
tcp and udp2
tcp and tcp.port == 80
tcp.port == 80 and tcp
tcp and udp and tcp.port == 80
tcp and (udp and tcp.port == 80) and (udp and tcp.port == 80)
(udp) and tcp
!(ip.src == 1.1.1.1)
ip.host == 110.249.201.149
ip.src_host == 10.1.1.1
ip.src == 106.14.64.222
tcp.port == 80
tcp.port >=90
tcp.port == 80 && (udp || tcp)
tcp.port == 80 && tcp.flags.reset == 0
tcp.port == 80 || tcp.port == 443 || tcp.port == 8080
ip.dst == 172.16.3.0/24
tcp.stream eq 2
tcp.segment.count ge 20
frame.len >= 1024 and frame.len <= 5000
frame.len ge 100
frame.time_epoch >=1563193996.060442000
frame.time_epoch >=1563193996.060442000  and frame.time_epoch <=1593193996.060442000
ip.dsfield.dscp == 0
ip.src eq 1.1.1.1 and not (ip.dst == 1.1.1.1)
ip.dst == 172.16.7.0/24 &&  ip.src == 172.16.3.0/24 && tcp.port == 80
ip.dst == 172.16.7.0/24 && ip.src == 172.16.3.0 &&  tcp.dstport == 80
ip.dst == 172.16.7.0/24 &&  tcp.dst.port == 80 or ip.src == 172.16.7.0/24
ip.dst == 172.16.7.0/24 && ip.src == 172.16.3.0/24 or  tcp.dstport == 80 or ip.src == 172.16.7.0/24
(ip.addr eq 192.168.1.2 and ip.addr eq 209.85.227.19) and (tcp.port eq 80 and tcp.port eq 52336)
ip.dst == 192.186.1.7 and tcp.flags.syn == 1 and tcp.flags.ack == 1
ip.src == 192.168.1.5 and tcp.flags.syn == 1 and tcp.payload != 0
ip.src == 192.168.1.5 and tcp.flags.reset==1
ip.src == 192.168.1.5 and tcp.window_size == 0 and tcp.flags.syn ne 1 and tcp.flags.fin !=1 and tcp.flags.reset !=1
ip.src == 125.64.14.216 and (ip.dst!= 110.249.201.149 and ip.dst!= 110.249.201.150) or tcp.dstport == 80
ip.src == 125.64.14.216 and tcp.seq == 0 and tcp.flags.syn == 1
ip.dst == 110.249.201.149 and tcp.seq == 0 and tcp.flags.syn == 1 and tcp.flags.ack == 1
tcp.flags.ack == 1 && tcp.seq==1 && tcp.ack==1 && !(tcp.flags.fin == 1)&& !http && tcp.len == 0
eth.src == 00:00:0c:07:ac:14
eth.src == 00:00:0c:07:ac:14 and eth.dst == f0:1f:af:db:14:f5
eth.src == 00:00:0c:07:ac:14 or eth.dst == f0:1f:af:db:14:f5
eth.dst == ff:ff:ff:ff:ff:ff
